TheMoon Malware Rises Again with Malicious Botnet for Hire
Outdated SOHO routers and IoT devices being hijacked by TheMoon to operate an anonymous hacker botnet service called Faceless.
![Full moon against Chilkat Mountains and Lynn Canal in Southeast Alaska Full moon against Chilkat Mountains and Lynn Canal in Southeast Alaska](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf0d27632c4790c49/6606fe722485e75aa7d53a81/moon-Design_Pics_Inc-Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
After disappearing for several years, TheMoon has returned with a botnet army around 40,000 strong, made up of hijacked small home and office (SOHO) devices and available for hire as a proxy service for cybercriminals looking to obscure their traffic origins.
The cybercrime botnet service, called Faceless, costs less than a dollar per day, according to the researchers at Lumen Technologies' Black Lotus Labs, who are warning about the return of TheMoon after the malware group disappeared in 2019, before reemerging back on the scene in 2023. By the beginning of 2024, TheMoon had amassed bots from across 88 countries to operate its Faceless service.
"We believe these cybercriminals [using Faceless] are using these networks to steal data and information from their victims, including the financial sector," Mark Dehus, senior director of threat intelligence at Lumen Black Lotus Labs, said in a statement. "TheMoon malware is a serious threat not only to the owners of the compromised SOHO devices, but also the victims exploited through this anonymous proxy network."
John Gallagher, vice president of Viakoo Labs at Viakoo, noted that the types of endpoints that TheMoon looks to bring to the dark side are somewhat sitting ducks.
"IoT devices are designed to be 'set it and forget it,' leading to their being favored by threat actors even if they are not end of life (they are likely to be unmanaged and not updated)," he said in an emailed statement. "This is a much bigger issue for enterprises than consumers. The operators of IoT devices are often cost centers, and there's an incentive to not replace equipment unless it isn’t functional anymore. Enterprises offer vast fleets of IoT devices for threat actors to leverage for DDoS and other attack vectors."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024